Low firefox Logic Error 🔧 Commit mapped

Overview

Low
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
Impactlow
DescriptionMitigation bypass in the DOM: Security component
ComponentNetworking
Bug ClassLogic Error
Tracker2004804
Fix commit4977228f2c7b (firefox) +6/-2
CISA KEVNot listed
CreditedManojkumar Jaganathan
Disclosed2026-05-19

Files Changed

  • netwerk/base/LoadInfo.cpp
diff --git a/netwerk/base/LoadInfo.cpp b/netwerk/base/LoadInfo.cpp
index 4b2d68f47fb..5359994177e 100644
--- a/netwerk/base/LoadInfo.cpp
+++ b/netwerk/base/LoadInfo.cpp
@@ -340,8 +340,12 @@ LoadInfo::LoadInfo(
     if (nsMixedContentBlocker::IsUpgradableContentType(
             mInternalContentPolicyType)) {
       // Check the load is within a secure context but ignore loopback URLs
-      if (mLoadingPrincipal->GetIsOriginPotentiallyTrustworthy() &&
-          !mLoadingPrincipal->GetIsLoopbackHost()) {
+      nsCOMPtr<nsIPrincipal> precursorPrincipal =
+          mLoadingPrincipal->GetPrecursorPrincipal();
+      nsCOMPtr<nsIPrincipal> requestingPrincipal =
+          precursorPrincipal ? precursorPrincipal : mLoadingPrincipal;
+      if (requestingPrincipal->GetIsOriginPotentiallyTrustworthy() &&
+          !requestingPrincipal->GetIsLoopbackHost()) {
         if (StaticPrefs::security_mixed_content_upgrade_display_content()) {
           mBrowserUpgradeInsecureRequests = true;
         } else {
Loading diff…